Security audit

WordPress REST API

Security checks for vulnerabilities and agentic risk

Overview

This WordPress REST helper is mostly purpose-aligned, but its credential-handling script can expose application passwords if used carelessly or with an unsafe URL.

Review before installing. Use this only with test or narrowly scoped WordPress application passwords, prefer HTTPS-only targets, avoid putting real application passwords directly in shell history, and do not use authenticated calls with absolute --route URLs unless the script is fixed to enforce same-origin HTTPS behavior.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/inspect-rest-api.sh:43
Finding: Application Password Exposed Through Command-Line Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/inspect-rest-api.sh:74
Finding: Basic Authentication Credentials Can Be Transmitted Over Plaintext HTTP
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/inspect-rest-api.sh:74
Finding: Absolute Route URL Can Redirect Trusted-Site Credentials to an Arbitrary Origin
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill advertises broad WordPress REST functionality including authentication flows and read/write operations, but the described behavior is primarily route discovery and generic inspection. This mismatch can mislead users or upstream agents into assuming safe support for authenticated or write operations that are not actually implemented or constrained, increasing the chance of insecure workarounds, accidental misuse, or overtrust in the skill's capabilities.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell-based scripts and relies on file reads, but it does not declare an explicit tool scope such as allowed tools or permissions. That omission weakens least-privilege boundaries and can let the runtime grant broader capabilities than operators expect, especially in environments that use metadata to enforce tool restrictions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This shell script performs an authenticated network request by passing --user credentials to curl, which sends the username and app password to the target URL. While the usage text shows the arguments, there is no explicit warning, confirmation, or user-facing disclosure that credentials will be transmitted over the network to the specified site.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.